gdhcp in ConnMan before 1.39 could be used by network-adjacent attackers to leak sensitive stack information, allowing further exploitation of bugs in gdhcp.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A stack-based buffer overflow in dnsproxy in ConnMan before 1.39 could be used by network adjacent
    attackers to execute code. (CVE-2021-26675)

  - gdhcp in ConnMan before 1.39 could be used by network-adjacent attackers to leak sensitive stack
    information, allowing further exploitation of bugs in gdhcp. (CVE-2021-26676)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - gdhcp in ConnMan before 1.39 could be used by network-adjacent attackers to leak sensitive stack
    information, allowing further exploitation of bugs in gdhcp. (CVE-2021-26676)

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6236-1 advisory.

    It was discovered that ConnMan could be made to write out of bounds. A remote attacker could possibly use     this issue to cause ConnMan to crash, resulting in a denial of service, or possibly execute arbitrary     code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-26675, CVE-2021-33833)

    It was discovered that ConnMan could be made to leak sensitive information via the gdhcp component. A     remote attacker could possibly use this issue to obtain information for further exploitation. This issue     only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-26676)

    It was discovered that ConnMan could be made to read out of bounds. A remote attacker could possibly use     this issue to case ConnMan to crash, resulting in a denial of service. This issue only affected Ubuntu     16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-23096, CVE-2022-23097)

    It was discovered that ConnMan could be made to run into an infinite loop. A remote attacker could     possibly use this issue to cause ConnMan to consume resources and to stop operating, resulting in a denial     of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu     22.04 LTS. (CVE-2022-23098)

    It was discovered that ConnMan could be made to write out of bounds via the gweb component. A remote     attacker could possibly use this issue to cause ConnMan to crash, resulting in a denial of service, or     possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04     LTS, and Ubuntu 22.04 LTS. (CVE-2022-32292)

    It was discovered that ConnMan did not properly manage memory under certain circumstances. A remote     attacker could possibly use this issue to cause ConnMan to crash, resulting in a denial of service, or     possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04     LTS, and Ubuntu 22.04 LTS. (CVE-2022-32293)

    It was discovered that ConnMan could be made to write out of bounds via the gdhcp component. A remote     attacker could possibly use this issue to cause ConnMan to crash, resulting in a denial of service, or     possibly execute arbitrary code. (CVE-2023-28488)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202107-29 (ConnMan: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in connman. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

This update for connman fixes the following issues :

Update to 1.39 (boo#1181751) :

  - Fix issue with scanning state synchronization and iwd.

  - Fix issue with invalid key with 4-way handshake     offloading.

  - Fix issue with DNS proxy length checks to prevent buffer     overflow. (CVE-2021-26675)

  - Fix issue with DHCP leaking stack data via uninitialized     variable. (CVE-2021-26676)

Update to 1.38 :

  - Fix issue with online check on IP address update.

  - Fix issue with OpenVPN and encrypted private keys.

  - Fix issue with finishing of VPN connections.

  - Add support for updated stable iwd APIs.

  - Add support for WireGuard networks.

Update to 1.37 :

  - Fix issue with handling invalid gateway addresses.

  - Fix issue with handling updates of default gateway.

  - Fix issue with DHCP servers that require broadcast flag.

  - Add support for option to use gateways as time servers.

  - Add support for option to select default technology.

  - Add support for Address Conflict Detection (ACD).

  - Add support for IPv6 iptables management.

Change in 1.36 :

  - Fix issue with DNS short response on error handling.

  - Fix issue with handling incoming DNS requests.

  - Fix issue with handling empty timeserver list.

  - Fix issue with incorrect DHCP byte order.

  - Fix issue with AllowDomainnameUpdates handling.

  - Fix issue with IPv4 link-local IP conflict error.

  - Fix issue with handling WISPr over TLS connections.

  - Fix issue with WiFi background scanning handling.

  - Fix issue with WiFi disconnect+connect race condition.

  - Fix issue with WiFi scanning and tethering operation.

  - Fix issue with WiFi security change handling.

  - Fix issue with missing signal for WPS changes.

  - Fix issue with online check retry handling.

  - Add support for systemd-resolved backend.

  - Add support for mDNS configuration setup.

A remote information leak vulnerability and a remote buffer overflow vulnerability were discovered in ConnMan, a network manager for embedded devices, which could result in denial of service or the execution of arbitrary code.

For Debian 9 stretch, these problems have been fixed in version 1.33-3+deb9u2.

We recommend that you upgrade your connman packages.

For the detailed security status of connman please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/connman

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A remote information leak vulnerability and a remote buffer overflow vulnerability were discovered in ConnMan, a network manager for embedded devices, which could result in denial of service or the execution of arbitrary code.

ID	Name	Product	Family	Severity
403872	Alpine: multiple connman packages: security update to 1.39-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
403872	Alpine: multiple connman packages: security update to 1.39-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
403871	Alpine: multiple connman packages: security update to 1.38-r4	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
403871	Alpine: multiple connman packages: security update to 1.38-r4	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
400274	Alpine: multiple connman packages: security update to 1.38-r3 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
400274	Alpine: multiple connman packages: security update to 1.38-r3 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
178482	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 : ConnMan vulnerabilities (USN-6236-1)	Nessus	Ubuntu Local Security Checks	critical
156988	GLSA-202107-29 : ConnMan: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
147844	openSUSE Security Update : connman (openSUSE-2021-416)	Nessus	SuSE Local Security Checks	high
146361	Debian DLA-2552-1 : connman security update	Nessus	Debian Local Security Checks	high
146353	Debian DSA-4847-1 : connman - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2021-26676

medium

Tenable Plugins

high

high

medium

medium

medium

medium

critical

critical

high

high

high